CVE-2023-36824: Redis heap overflow in COMMAND GETKEYS key extraction

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high EPSS, but exploitation requires authentication and no KEV or public exploit is documented.

What it is

Redis 7.0 before 7.0.12 can trigger a heap overflow when extracting key names from a command and its arguments. The flaw affects authenticated users running crafted COMMAND GETKEYS or COMMAND GETKEYSANDFLAGS calls, and ACL users whose rules match key names running crafted commands with variadic key lists. It matters because it can leak heap memory, corrupt the heap, and potentially allow remote code execution.

Impact

An authenticated attacker can read random heap memory, corrupt heap state, and potentially achieve remote code execution in the Redis process.

Attack surface

Reached over the network through the Redis protocol by an authenticated user; no user interaction is required. The CVSS vector shows network access, low privileges, and no UI, so any account able to issue the relevant commands or matching ACL rules is a path.

Exploitation

Not listed in CISA KEV and no ransomware use is documented. EPSS is very high at 0.77422 (99.5th percentile), and references are release notes, vendor advisory, and third-party advisories only, with no public exploit tag.

What to do

• Upgrade Redis to 7.0.12 or later, which contains the patch.
• If immediate upgrade is not possible, restrict COMMAND GETKEYS and COMMAND GETKEYSANDFLAGS via ACLs and limit which users can run them.
• Review ACL rules that match key names and tighten them so untrusted users cannot trigger variadic key-name parsing paths.
• Apply the Fedora package updates referenced in the advisory for affected Fedora builds.
• Limit network exposure of Redis to trusted hosts and require strong authentication.

Detection

• Monitor Redis logs and command streams for COMMAND GETKEYS or COMMAND GETKEYSANDFLAGS issued by non-administrative users.
• Alert on Redis process crashes, restarts, or memory errors that could indicate heap corruption.
• Audit ACL configurations for rules that match key names and correlate with unusual command activity.
• Watch for unexpected outbound connections or child processes from the Redis host that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.